Hacker Timesnew | past | comments | ask | show | jobs | submitlogin

The funniest part about these discussions is that we're discussing an optimization that exclusively helps attackers. Virtually all HMAC candidate hashes are correct all the way through the final byte, meaning that even in a classic short-circuited compare, you still have to read everything. In virtually all traffic, you never get to take that short circuit. The only time short-circuited comparisons ever make things faster is when an attacker is waiting for a rejection.


However, in many high-level languages == is written in C, and reimplementing it in the high-level language can be quite slow in comparison.


You know, it'd be handy if such high-level languages implemented a separate =$= operator that worked just like ==, but was timing-independent.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: